cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
PawelEm
Level 8
Report Inappropriate Content
Message 1 of 6

Reproduce rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) ..."

I want to make a custom version of mcafee defined rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) from common user folders" I have plenty of false positives coused by this rule and want to make some exclusions. Tired to sort this out on community but it didn't work for me (link below) Can i ask for some help in this case? https://community.mcafee.com/t5/Endpoint-Security-ENS/Exclusions-for-Access-protection-s-quot-Block-...
5 Replies

Re: Reproduce rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) ...&q

I think this should do it.

Rule {
Process {
Include AggregateMatch {
Include OBJECT_NAME { -v "wscript.exe" }
Include PROCESS_CMD_LINE {
-v "*c:\\users*"
-v "*c:\\programdata*"
-v "c:\\windows\\temp*"
}
Exclude PROCESS_CMD_LINE {
-v "*FalsePositivesHere*"
}
}
Include AggregateMatch {
Include OBJECT_NAME { -v "cscript.exe" }
Include PROCESS_CMD_LINE {
-v "*c:\\users*"
-v "*c:\\programdata*"
-v "c:\\windows\\temp*"
}
Exclude PROCESS_CMD_LINE {
-v "*FalsePositivesHere*"
}
}
}
Target {
Match SECTION {
Include OBJECT_NAME { -v "version.dll" }
Include -access "CREATE"
}
}
}

 

When you want to block, change "version.dll" to just "**" 

From an attack perspective, a bit cleaner and to minimize risk, you might consider the following:

Block Office from Executing these two processes.
Change the default file association of various scripts from c/wscript to notepad.  So a user can't just double click them.  Instead, they have to define the execution in a command line.

Dave

Buijspa
Level 7
Report Inappropriate Content
Message 3 of 6

Re: Reproduce rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) ...&a

Hi,

This ER is working as expected.

Where can I find the command line launched by cscript.exe/wscript.exe ?

For the moment, this information is not present in the logs, only "C:\Windows\SysWOW64\cscript.exe, which accessed the process version.dll".

Thanks for your help!

Kr,

buijspa

Buijspa
Level 7
Report Inappropriate Content
Message 4 of 6

Re: Reproduce rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) ...&a

For some alerts I received this :

Source Description:

cscript \windows\system32\slmgr.vbs -ato

 

But for the majority only this :

Source Description:

cscript.exe

Re: Reproduce rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) ...&a

Hard to say without 1) knowing your rule logic and 2) knowing the actual command line (is there really one?).  

If you are using 10.7 you might consider going this route on the rule, which should give you even more visibility:

Rule {
	Process {
		Include OBJECT_NAME { -v "**" }
	}
	Target {
		Match PROCESS {
			Include AggregateMatch {
				Include OBJECT_NAME { -v "wscript.exe" }
				Include PROCESS_CMD_LINE {
					-v "*c:\\users*"
					-v "*c:\\programdata*"
					-v "c:\\windows\\temp*"
				}
				Exclude PROCESS_CMD_LINE {
					-v "*FalsePositivesHere*"
				}
			}
			Include AggregateMatch {
				Include OBJECT_NAME { -v "cscript.exe" }
				Include PROCESS_CMD_LINE {
					-v "*c:\\users*"
					-v "*c:\\programdata*"
					-v "c:\\windows\\temp*"
				}
				Exclude PROCESS_CMD_LINE {
					-v "*FalsePositivesHere*"
				}
			}
			Include -access "CREATE"
		}
	}
}
Buijspa
Level 7
Report Inappropriate Content
Message 6 of 6

Re: Reproduce rule "Executing scripts by Windows script host (CScript.exe or Wscript.exe) ...&a

Hi Dave,

Thanks for your swift reply.

Indeed, it works better with this ER : now I see that the cscript process is launched from 

"C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe" "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\main.js"

Thanks for your help!

Kind regards,

buijspa

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community